There is always a friction between the usability and security of a network; we are trying to always find the sweet spot that balances the two.

Information Security: Act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction.

Information Systems Security: Act of protecting the systems that hold and process critical data.

Threats and Vulnerabilities

Threat: Anything that could cause harm, loss, damage, or compromise to information technology systems.¹1. Threats are external; e.g., natural disasters, cyber-attacks, data integrity breaches, disclosure of confidential information, etc.

• We cannot fully control all threats, but we can try to minimize their impact.

Vulnerability: Any weakness in the system design or implementation.²2. Vulnerabilities are internal; e.g., software bugs, misconfigured software, improperly protected network devices, missing security patches, lack of physical security, etc.

• We can control vulnerabilities by mitigating, transferring, avoiding, or accepting the risk.

Key Takeaway: The risk to enterprise systems is in the intersection of threats and vulnerabilities.

• Cybersecurity is about managing those risks.

Risk Management: Finding different ways to minimize the likelihood of an outcome occurring and achieve the desired outcomes.

CIA Triad

Confidentiality

Ensures that information is only accessible to those with the appropriate authorization.

Importance:

1. Protect personal privacy
2. Maintain a business advantage (protecting proprietary data)
3. Achieve regulatory compliance (Regulations on PII³3. Personally Identifiable Information, PHI⁴4. Protected Health Information, various types of financial data, etc.)

Five Methods

1. Encryption: Process of converting data into code to prevent unauthorized access.
2. Access Controls: Ensure only authorized personnel can access certain types of data.
3. Data Masking: Method that involves obscuring data within a database to make it inaccessible for unauthorized users while retaining the real data’s authenticity and use for authorized users.
4. Physical Security Measures: Used to ensure confidentiality for physical types of data and for digital information contained on servers and workstations.
5. Training and Awareness: Conducting regular training on the security awareness best practices that employees can use to protect sensitive data.

Integrity

Ensures that data remains accurate and unaltered unless modified by an authorized individual.

• Verifies the accuracy and trustworthiness of data over its entire lifecycle.
• Ensures that decisions are based on correct information and with expected outcomes.

Importance:

1. Ensure Data Accuracy
2. Maintain Trust
3. Ensure System Operability

Five Methods

1. Hashing: Process of converting data into a fixed-size value. The result of a hashing algorithm is called a hash digest. A hash digest can serve like a digital fingerprint for data.
2. Digital Signatures: Use encryption to ensure integrity and authenticity. Created by hashing a file/message and then encrypting the hash digest with a user’s private key using asymmetric encryption.
3. Checksums: Method to verify the integrity of data during transmission.
4. Access Controls: Ensure that only authorized individuals can modify data and reduce the risk of unintentional or malicious alterations.
5. Regular Audits: Involve reviewing logs and operations to ensure that only authorized changes have been made and any discrepancies are addressed.

Availability

Ensures that information, systems, and resources are accessible and operational when needed by authorized users.

Importance:

1. Preventing loss⁵5. Loss of availability can mean significant loss of money (e.g., e-commerce) or life (e.g., hospitals).
2. Maintaining customers’ trust
3. Maintaining organization’s reputation

Redundancy

Duplication of critical components or functions of a system with the intention of enhancing its reliability (Having backups).

1. Server: Involves using multiple servers in a load balance or failover configuration so that if one is overloaded or fails, the other servers can take over the load to continue supporting end users.
2. Data: Involves storing data in multiple places.⁶6. e.g., RAID, using on-premises and cloud-based backup systems, etc.
3. Network: Ensures that if one network path fails, data can still travel through another route.
4. Power: Involves using backup power sources to ensure that an organization’s systems remain operational during power disruption/outages.

Non-repudiation

Guaranteeing that a specific action has taken place and cannot be denied by the parties involved.

• Providing undeniable proof in digital transactions.

The best tool for achieving non-repudiation is digital signatures.

Importance:

1. Confirm Authenticity of Digital Transactions
2. Ensuring Integrity
3. Providing Accountability

AAA of Security

Authentication

Ensures individuals or entities are who they claim to be during a communication or transaction.

• Process of verifying the identity of a user or system.

Importance:

1. Prevent unauthorized access
2. Protect user data and privacy
3. Ensure resource validity⁷7. Ensure only valid, authenticated users can consume resources.

Five Methods

1. Something You Know (Knowledge Factor): Relies on information a user can recall (username and password).
2. Something You Have (Possession Factor): Relies on user presenting a physical item to authenticate themselves (employee ID card and text sent to phone).
3. Something You Are (Inherence Factor): Relies on user providing a unique physical or behavioral characteristic of the person to validate that they are who they claim to be (Biometric authentication).
4. Something You Do (Action Factor): Relies on the user conducting a unique action to prove who they are (gait and handwriting).
5. Somewhere You Are (Location Factor): Relies on user being in a certain geographic location before access is granted.

2FA & MFA

• 2FA (Two-Factor Authentication): When you combine two of the above authentication methods.
• MFA (Multi-Factor Authentication): When you combine two or more authentication methods.

Authorization

Permissions and privileges granted to users or entities after they have been authenticated.

• Defines what actions or resources a user can access.
• Set of rules and policies that are used to dictate what actions users can perform once verified.

Importance:

1. Protect sensitive data⁸8. While nurses can see patients’ information, only specific doctors can prescribe medication.
2. Maintain system integrity⁹9. Prevents accidental and intentional system misconfigurations/data alterations.
3. Streamline user experience¹⁰10. A student’s view of a course is vastly different than an instructor’s view of a course.

Three Methods

1. Role-based
2. Rule-based
3. Attribute-based

Accounting

Ensures all user activities and resource usage are properly tracked and recorded.

• Typically used for auditing or billing purposes.

Importance:

1. Transparency
2. Security
3. Accountability

Things logged:

1. Logging into the system
2. Accessing files
3. Modifying configuration settings
4. Downloading or installing software
5. Attempting unauthorized actions on systems and networks

Five Goals

1. Audit Trail: Provides a chronological record of all user activities that can be used to trace changes, unauthorized access, or anomalies back to a specific user or point in time.
2. Regulatory Compliance: Maintains a comprehensive record of all users’ activities.
3. Forensic Analysis: Uses detailed accounting and event logs that can help cybersecurity experts understand what happened, how it happened, and how to prevent similar incidents from occurring again in the future.
4. Resource Optimization: Organizations can optimize system performance and minimize costs by tracking resource utilization and allocation decisions.
5. User Accountability: Thorough accounting ensures users’ actions are monitored and logged, deterring potential misuse and promoting adherence to other organization’s policies.

Technologies Used

1. Syslog Servers: Used to aggregate logs from various network devices and systems so that system administrators can analyze them to detect patterns or anomalies in the organization’s systems.
2. Network Analyzers: Used to capture and analyze network traffic to gain detailed insights into all the data moving within a network.
3. Security Information and Event Management (SIEM): Provides real-time analysis of security alerts generated by various hardware and software infrastructures in an organization.

Security Controls

Measures of mechanisms put in place to mitigate risks and protect the CIA of information systems and data.

Security Control Categories

1. Technical: The technologies, hardware, and software mechanisms that are implemented to manage and reduce risks.¹¹11. e.g., firewalls, encryption processes, intrusion detection systems.
2. Managerial: Involve the strategic planning and governance side of security (risk assessment, security policies, training programs).
3. Operational: Procedures and measures that are designed to protect data on a day-to-day basis.¹²12. Being required to change your password every 90 days is an operational control. Mainly governed by internal processes and human actions.
4. Physical: Tangible, real-world measures taken to protect assets.¹³13. e.g., shredding sensitive documents, security guards, locking the doors.

Security Control Types

1. Preventative: Proactive measured implemented to thwart potential security threats or breaches (e.g., a firewall can block malicious packets).
2. Deterrent: Aim to discourage potential attackers by making the effort seem less appealing or more challenging (e.g., an ADT sign outside your house).
3. Detective: Monitor and alert organizations to malicious activities as they occur or shortly thereafter (e.g., an IDS notifying system administrators).
4. Corrective: Mitigate any potential damage and restore the systems to their normal state. Used after a detective control.
5. Compensating: Alternative measures that are implanted when primary security controls are not feasible or effective (e.g., utilizing a VPN on a legacy network protocol).
6. Directive: Often rooted in policy or documentation and set the standards for behavior within an organization (e.g., Acceptable Use Policy).

Zero Trust

Security model that operates on the principle that no one, whether on the inside or outside of the organization, should be trusted by default.

• Demands verification for every device, user, and transaction within the network, regardless of its origin.

Creating a zero trust architecture requires using a control plane (lays out policies and procedures) and data plane (ensures policies are properly executed).

Control Plane

The overarching framework and set of components responsible for defining, managing, and enforcing the policies related to user and system access within an organization.

Key Elements

1. Adaptive Identity: Use adaptive identities that rely on real-time validation that takes into account the user’s behavior, device, location, and more.
2. Threat Scope Reduction: Limit users’ access to only what they need for their work tasks. This drastically reduces the network’s potential attack surface.
3. Policy-driven Access Control: Entails developing, managing, and enforcing user access policies based on their roles and responsibilities.
4. Secured Zones: Isolated environments within a network that are designed to house sensitive data.

Policy Engine & Policy Administrator

• Policy Engine: Cross-references the access request with its predefined policies.
• Policy Administrator: Used to establish and manage access policies.

Data Plane

1. Subject/System: Refers to the individual or entity attempting to gain access.
2. Policy Enforcement Point: Allow or restrict access, and it will effectively act as a gatekeeper to the sensitive area of the systems or networks.

Gap Analysis

Process of evaluating the difference between an organization’s current and desired performance.

Steps:

1. Define the scope of the analysis
2. Gather data on the current state of the organization
3. Analyze the data to identify the gaps
4. Develop a plan to bridge the gap

Two Types of Gap Analysis

1. Technical: Involves evaluating an organization’s current technical infrastructure and identifying any areas where it falls short of the technical capabilities required to fully utilize their security solutions.
2. Business: Involves evaluating an organization’s current business processes and identifying any areas where they fall short of capabilities required to fully utilize cloud-based solutions.

Plan of Action and Milestones (POA&M)

Outlines the specific measures to address each vulnerability, allocate resources, and set up timelines for each remediation task that is needed.

Remember: You will never have enough resources to address every vulnerability; you will have to prioritize what goes into the POA&M.